hardMultiple ChoiceObjective-mapped
SC-200 Practice Question: A security analyst is preparing to use a Jupyter…
A security analyst is preparing to use a Jupyter notebook for threat hunting in Microsoft Sentinel. Which of the following sequences of actions is correct to start executing the notebook?
⚠ Common exam trap
Watch out — candidates often assume the workspace connection should be established first (as in typical cloud workflows), but in Sentinel notebooks, the compute environment must be ready before any authentication or file operations can occur.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Provision compute → Clone Sentinel notebooks → Connect to workspace → Execute cells
The correct sequence to start executing a Jupyter notebook for threat hunting in Microsoft Sentinel is to first provision compute (i.e., create a compute instance in Azure Machine Learning), then clone the Sentinel notebooks from the official GitHub repository, connect to the Sentinel workspace using the msticpy library, and finally execute the cells. This order ensures the compute environment is ready before loading the notebooks and establishing the workspace connection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Provision compute → Clone Sentinel notebooks → Connect to workspace → Execute cells
Why this is correct
This sequence follows Microsoft's recommended readiness path for Sentinel notebooks: the Azure ML compute instance must be created first because Jupyter kernels, the Python environment, and MSTICpy dependencies are all bound to that compute target. Once the compute is live, cloning the official Sentinel notebooks populates the workspace with query templates while ensuring the files are accessible to that same compute. Only then is the notebook able to establish an authenticated connection to the Log Analytics/Sentinel workspace, normally via MSTICpy's `nbinit` or a Microsoft Entra sign-in, before any cells are executed.
- ✗
Clone Sentinel notebooks → Provision compute → Connect to workspace → Execute cells
Why it's wrong here
Cloning the notebook files before provisioning compute is not fatal, but it inverts the documented workflow: a fresh compute instance is what supplies the Python interpreter, installed packages, and the Jupyter kernel, so without it there is no runtime on which to open and run a cloned notebook. If compute is added later, the analyst must still attach the compute to the notebook folder and may have to restart the kernel to pick up environment variables, creating needless friction. Microsoft recommends compute first specifically so notebooks are cloned into a location the compute is already managing.
- ✗
Connect to workspace → Provision compute → Clone Sentinel notebooks → Execute cells
Why it's wrong here
This order is invalid because the workspace connection step cannot execute before a compute instance exists: the connection is initiated from inside a running Jupyter cell, which means a compute target and kernel are prerequisites for the authentication call. Without prior compute provisioning, the notebook service has no Python process to run MSTICpy's `nbinit` or Azure Identity code, and no managed identity or device-login context is available. In the supported sequence, compute must be provisioned first, followed by cloning, and the workspace connect is the third step, immediately before execution.
- ✗
Provision compute → Connect to workspace → Clone Sentinel notebooks → Execute cells
Why it's wrong here
Cloning notebooks before connecting to workspace is acceptable, but connecting before cloning is not required; however, cloning after connect is still functional, but the recommended order is clone before connect. Option A is the most accurate.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SC-200 question from scratch — 209 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.